Hook
On August 14, 2025, Singapore police and the Cyber Security Agency (CSA) disclosed a scam that bled $11.8 million from an unnamed crypto company. The attack vector? A fake job interview. The immediate reaction from most observers is to file this under “another phishing incident.” But the technical details tell a different story—one that cuts to the core of how crypto firms have been systematically misallocating their security budgets. The real vulnerability is not in smart contracts, nor in private keys, but in the neglected layer between human trust and machine authentication.
Context
Singapore has positioned itself as Asia’s premier crypto hub, with a robust licensing framework under the Payment Services Act (PSA) and a reputation for regulatory clarity. The attacker exploited this very legitimacy. They impersonated a recruiter from a well-known tech company, used a domain that looked legitimate (e.g., @company-careers.com), and conducted a full interview process via Google Meet—with the camera off, claiming technical issues. The victim, a job seeker eager to land a role in the crypto space, was then directed to a fake coding test website that delivered a malicious payload. This was not a random spray-and-pray attack; it was a targeted, multi-stage operation that mirrored the sophistication of a nation-state espionage campaign.
From my 2017 ICO audit experience, I learned that the whitepaper promises rarely match technical reality. In 2025, the same gap exists between a firm’s security whitepaper and its actual session management practices. The crypto industry has spent years obsessing over smart contract audits, formal verification, and on-chain risk, while the backdoor remains wide open: the people, processes, and endpoints that connect to those chains.
Core
The attack chain is a textbook example of a combined social engineering and supply chain compromise. Let’s break it down step by step:
- Information Gathering: The attacker scouted LinkedIn for employees at a crypto firm, then crafted a fake recruiter profile mimicking a legitimate tech company. This is not unusual—LinkedIn is a cesspool of fake profiles, and crypto firms are prime targets because they are both high-value and often hiring aggressively in a bull market.
- Initial Phishing: Using a near-identical domain, the attacker sent a job offer email. The victim, thrilled by the opportunity, replied. The email passed basic SPF/DKIM checks because the domain was freshly registered and had no reputation.
- Trust Building: A Google Meet interview was scheduled. The recruiter kept the camera off, citing “bandwidth issues.” The interview was professional—they asked relevant technical questions, discussed the company’s stack, and even mentioned using Bitbucket for code reviews. This was a deliberate move to build credibility.
- Malware Delivery: The victim was told the next step was a “live coding test” on a platform that required downloading a custom application. The link pointed to a site that mimicked a legitimate coding assessment platform. The victim downloaded and executed the installer, which dropped a Remote Access Trojan (RAT) and an information stealer.
- Session Token Theft: This is the crucial pivot. The malware scraped browser cookies and session tokens from the victim’s machine. Since the victim was already logged into the company’s internal systems (e.g., Bitbucket, Jira, and corporate email) on their personal device, the attacker now had valid session tokens. Session tokens are the keys to the kingdom, and they completely bypass Multi-Factor Authentication (MFA). MFA only protects the initial login; once a session is established, the token is valid until it expires—often for weeks or months. The attacker now had persistent access without triggering any MFA prompt.
- CI/CD Pipeline Compromise: With access to the company’s Bitbucket repositories, the attacker modified the CI/CD configuration files. They inserted a backdoor into the build pipeline that would deploy a malicious update to the internal server. In a classic supply chain attack, the automation system trusted the code changes because they came from a “legitimate” user account. The attacker then triggered a deployment, gaining remote access to the internal server hosting the company’s crypto treasury system.
- Credential Theft and Fund Transfer: From the internal server, the attacker stole API keys and credentials that bypassed transaction limits and approval workflows. They initiated a series of transfers totaling $11.8 million, likely to wallets under their control. The company’s own transaction monitoring rules did not flag the transfers because the attacker used valid credentials from a trusted internal IP.
This attack is a masterpiece of operational security failure. It used no zero-day vulnerabilities, no obscure protocol exploits. It simply weaponized the trust built into hiring processes and the blind trust granted to existing session tokens. The technical sophistication is not in the malware—it’s in the orchestration. The attacker understood that the average crypto company has a security posture that is “strong on-chain, weak off-chain.”
s chaos.
Contrarian
The prevailing narrative will be “better background checks” or “more employee training.” That is a comforting but superficial solution. The truth is that the industry’s obsession with smart contract audits is a red herring. The real vulnerability lies in the operational security of the human-machine interface. The contrarian angle: the victim firm likely had a top-tier smart contract audit, a bug bounty program, and even a formal security certification. None of that mattered because the attacker bypassed the chain entirely. They attacked the people who operate the systems, not the systems themselves.
The thesis held firm when the charts turned red: the bull market euphoria masks technical flaws. During a bull run, crypto companies hire aggressively, pushing security to the background. The attacker timed the recruitment campaign to coincide with a hiring surge, knowing that the hiring managers would be less vigilant. The solution is not to stop hiring, but to implement continuous authentication—where session tokens are bound to device fingerprints, IP geolocation, and behavioral patterns. In addition, CI/CD pipelines should never automatically trust changes from a single compromised account; they should require multi-party approval and cryptographic signing of every commit.
Another counter-intuitive insight: the attack does not necessarily mean the victim was a small startup. The presence of transaction limits and approval workflows suggests a mature organization with institutional controls. This is precisely the type of firm that regulators would point to as a model. Yet the attacker still succeeded. The lesson is that compliance does not equal security. The $11.8M loss is not just a financial hit; it is a signal that the entire industry’s approach to internal security is fundamentally broken.
s whitepaper vs. technical reality: the gap between a company’s security whitepaper and its actual session management practices is a chasm that attackers are exploiting with surgical precision.
Takeaway
This attack pattern will be replicated. The next wave of crypto security incidents will not come from code exploits, but from the seams between humans and machines. The question is not if, but when your firm will be tested. Will your session tokens be your undoing? The time to fix the blind spot is now, before the next recruiter sends a “coding test” to your most promising candidate.